CVE-2026-15467

HIGH

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster.

CVSS v3.1 Score

8.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

NETWORK

Complexity

LOW

Privileges

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Published: 8/10/2026Modified: 8/14/2026

Related Intelligence (0)

No articles currently reference this CVE.

References (5)

https://access.redhat.com/errata/RHSA-2026:53261 https://access.redhat.com/errata/RHSA-2026:53262 https://access.redhat.com/errata/RHSA-2026:53263 https://access.redhat.com/security/cve/CVE-2026-15467 https://bugzilla.redhat.com/show_bug.cgi?id=2499086